021add75eb8115ed09e6855a00e3aebaa0a5b519c37a5f716681e5cb79da18f1

Analysis

max time kernel
101s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2023, 01:07

Target

69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
Size

777KB
MD5

16b73908872a69102b5d782b946c1c95
SHA1

a446cc9879ae237478adabad394b0317cbb2679f
SHA256

69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e
SHA512

74c1a6e7b0c8d437d52ab0f14e3a9b8998cfafee46a34c825e7bf558c9e0adfee15d3bca28529b5c45349bf31afb7b2afc980606b4d04710027757a7d0e18a5e
SSDEEP

12288:jbkcdXHwni4IyS+GgvnMLQFVvfcwr5Xi0JUCnmozOQB/Xp3I5c0x:jbJNwLwQFZfZr9jfnmozOQB/Xe5Px

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 520 set thread context of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1892	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
1892	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91
PID 520 wrote to memory of 1892	520	69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe	91

C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
"C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe
  "C:\Users\Admin\AppData\Local\Temp\69087db34f2934a2bc582a76273d4f3d75e15fda3e900a56e8f89bcc04c8040e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1892

memory/520-133-0x00000000000C0000-0x0000000000188000-memory.dmp

Filesize
800KB

Download
memory/520-134-0x0000000005050000-0x00000000055F4000-memory.dmp

Filesize
5.6MB

Download
memory/520-135-0x00000000049F0000-0x0000000004A82000-memory.dmp

Filesize
584KB

Download
memory/520-136-0x0000000004AB0000-0x0000000004ABA000-memory.dmp

Filesize
40KB

Download
memory/520-137-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/520-138-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/520-139-0x0000000007E00000-0x0000000007E9C000-memory.dmp

Filesize
624KB

Download
memory/1892-140-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1892-142-0x0000000001410000-0x000000000175A000-memory.dmp

Filesize
3.3MB

Download
memory/1892-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download